Fine-grained classification on Caltech101
95.9AccuracyTPT
Evaluation results
| Method | Links | ||
|---|---|---|---|
| TPTPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 95.9 | 0.2 | |
| MTAPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 95.8 | 83.1 | |
| MTABackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 95.8 | 83.1 | |
| MTACategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 95.8 | 83.1 | |
| R-TPTPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 95.7 | 88.2 | |
| R-TPTBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 95.7 | 88.2 | |
| R-TPTCategory=Tuning-based, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 95.7 | 88.2 | |
| C-TPTPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 95.6 | 0.1 | |
| CLIPPre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 95.2 | 0.1 | |
| CLIPBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 95.2 | 0.1 | |
| CLIPCategory=Baseline, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 95.2 | 0.1 | |
| TTPBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 95.1 | 88.6 | |
| EnsemblePre-trained Backbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.04 | 94.9 | 83.6 | |
| EnsembleBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 94.9 | 83.6 | |
| AGCBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 94.4 | 99.4 | |
| MTABackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 94.3 | 72.1 | |
| TPTPre-trained on ImageNet=false2024.10 | 94.2 | — | |
| EnsembleBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 94.2 | 84.4 | |
| MACCategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 94.1 | 92.7 | |
| CLIPBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 94 | 0 | |
| CoCoOpPre-trained on ImageNet=true2024.10 | 93.8 | — | |
| CoOpPre-trained on ImageNet=true2024.10 | 93.7 | — | |
| R-TPTBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 93.7 | 82 | |
| EnsemblePre-trained on ImageNet=false2024.10 | 93.6 | — | |
| TTPBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 93.5 | 82.3 | |
| TTCCategory=Tuning-free, Backbone=CLIP-ViT-L/14, Attack Protocol=PGD-100, eps=4.02026.06 | 93.5 | 9.9 | |
| CLIP-VIT-B/16Pre-trained on ImageNet=false2024.10 | 93.4 | — | |
| AGCBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 92.2 | 97.9 | |
| MTABackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 92 | 76.3 | |
| MTABackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 92 | 76.3 | |
| EnsembleBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 91.7 | 83.8 | |
| T-VSSBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 91.7 | 76.6 | |
| CLIPPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 91.4 | 0.2 | |
| CLIPBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 91.4 | 0.2 | |
| CLIPBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Baseline2026.06 | 91.4 | 0.2 | |
| TTPBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 90.9 | 81.8 | |
| TTPBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 90.9 | 81.8 | |
| R-TPTPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 90.6 | 76.4 | |
| R-TPTBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 90.6 | 76.4 | |
| R-TPTBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 90.6 | 76.4 | |
| APMPre-trained on ImageNet=false2024.10 | 89.6 | — | |
| TTCBackbone=CLIP-ViT-L/14, Perturbation budget (epsilon)=4.02025.12 | 88.7 | 7.7 | |
| AGCBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 88.3 | 94.9 | |
| EnsembleBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 88.2 | 74.9 | |
| TTCBackbone=ViT-B/16, Epsilon (ε)=4/2552026.05 | 87.6 | 8.4 | |
| R-TPTPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 86.7 | 79.8 | |
| R-TPTBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 86.7 | 79.8 | |
| TTCBackbone=ViT-B/32, Epsilon (ε)=4/2552026.05 | 86.5 | 22.7 | |
| TTCBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Test-time Defense2026.06 | 86.5 | 22.7 | |
| FAREPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 86.3 | 85.4 | |
| FAREBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 86.3 | 85.4 | |
| TTPBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 86 | 86.4 | |
| CLIPPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 85.9 | 2.6 | |
| CLIPBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 85.9 | 2.6 | |
| APT+TeCoAPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 82.8 | 82.8 | |
| APT+TeCoABackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 82.8 | 82.8 | |
| APT+TeCoAPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 81.4 | 80.2 | |
| APT+TeCoABackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 81.4 | 80.2 | |
| C-TPT*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 79.8 | 47.3 | |
| MTA*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 79.7 | 55.7 | |
| TeCoAPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 79.3 | 78 | |
| TPT*Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 79.3 | 52.7 | |
| TeCoABackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 79.3 | 78 | |
| R-TPT + ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 79.27 | 65.07 | |
| ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Lightweight Defense, Input Modality=Vision Only2026.03 | 79.07 | 50.59 | |
| CLIP (Robust)Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Baseline2026.03 | 78.82 | 43.45 | |
| TeCoAPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 78.3 | 78.3 | |
| TeCoABackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 78.3 | 78.3 | |
| Ensemble + ET3Pre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 76.23 | 61.38 | |
| R-TPTPre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations + Prompt Tuning, Input Modality=Vision + Text2026.03 | 75.58 | 61.01 | |
| EnsemblePre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Multiple Augmentations, Input Modality=Vision Only2026.03 | 73.02 | 55.66 | |
| TTCPre-trained Model=TeCoA CLIP-ViT-B/32, Attack Protocol=PGD-100 (ϵ = 4/255), Defense Category=Lightweight Defense, Input Modality=Vision Only2026.03 | 71.26 | 44.9 | |
| APTPre-trained Backbone=ViT-B/32, Perturbation budget (epsilon)=4.02025.04 | 10.7 | 0.4 | |
| APTBackbone=CLIP-ViT-B/32, Epsilon (ϵ)=4/255, Defense Category=Training-time Defense2026.06 | 10.7 | 0.4 | |
| APTPre-trained Backbone=ResNet50, Perturbation budget (epsilon)=1.02025.04 | 2.9 | 1.7 | |
| APTBackbone=ResNet50, Attack Type=PGD, Epsilon (ε)=1.02026.05 | 2.9 | 1.7 |